Local update system

New step-based update workflow for offline/self-hosted deployments. The Backup upload endpoint detects archives where manifest.type == "update" and manifest.software == "flatboard", validates the manifest (edition, semver version, checksum), and routes them to storage/updates/ instead of storage/backups/. The admin/updates page scans storage/updates/, displays a card for each valid archive that is newer than the installed version, and lets the admin apply it via a 5-step progress UI (verify → backup → extract → deploy → cleanup). Each step is executed over a separate CSRF-protected AJAX call with retry logic; a full automatic backup is created before any file is deployed; protected paths (stockage/, uploads/, .env, .htaccess, install.php) are never overwritten. Archives older than the current version are listed separately and can be deleted. Translation keys added for all 5 languages.

• Local update: plugin.json / theme.json preservation: The deployUpdateFiles() step previously overwrote plugin.json and theme.json with a plain copy(), erasing user data such as "active" state, plugin settings stored under the "plugin" key, and customised theme colours in "variables". These files are now merged instead of replaced: existing keys are preserved, new keys introduced by the archive are added, and nested associative arrays (e.g. form_config.fields) are deep-merged recursively. Indexed arrays (e.g. hook lists) are union-merged without duplicates. A direct copy fallback is used if either JSON file is unreadable or invalid.

Added

• Flatboard is now fully self-contained: Flatboard can now manage updates, plugin installations, and theme installations directly from the admin panel, making it completely independent from external tools or manual file transfers.

• Plugin installation from archive(admin/plugins): New "Install a plugin" button opens a modal where the admin can upload a ZIP archive. The server validates the MIME type, extension, size (respects PHP upload_max_filesize / post_max_size), ZIP integrity, path-traversal safety, and the presence of a plugin.json inside a top-level directory. The archive is extracted directly into plugins/ from the PHP temp file (no permanent copy kept) and all caches are invalidated. The new route POST /admin/plugins/upload is CSRF-protected. Translation keys added for all 5 languages.
  

• Theme installation from archive(admin/themes): Same mechanism for themes — new "Install a theme" button and modal, route POST /admin/themes/upload, validates theme.json inside a top-level directory, invalidates theme asset cache after extraction. Translation keys added for all 5 languages.
  

It’s fully integrated into Flatboard 5.2.0, so I’m closing this discussion.